Andrew, thanks - the rval is the only PROTECT needed there (attributes are protected by the contained object and symbols don't need protection). But, please, in the future use svn diff or be more specific as there are several different do_system in different files so chasing them is a bit annoying.

(In reply to comment #1)
> Andrew, thanks - the rval is the only PROTECT needed there (attributes are
> protected by the contained object and symbols don't need protection). But,
> please, in the future use svn diff or be more specific as there are several
> different do_system in different files so chasing them is a bit annoying.
Simon, you are of course right about symbols. But on my platform at least, C function arguments are evaluated from right to left, so for example in
setAttrib(rval, install("status"), ScalarInteger(res));
the compiler first evaluates ScalarInteger(res), and then evaluates install("status"). If this install gives rise to a garbage collection, then the ScalarInteger will be blown away *before* it has been attached as an attribute to rval. (Which is precisely what happens in CXXR.) The same thing applies to the setting of the errmsg attribute.
As to which do_system() I meant, well the subject line did say sys-unix.c :-)
Andrew